Multilevel analysis of self-similar network traffic

ABSTRACT

Self-similar data communication in network traffic is modeled real time and is analyzed using a Markov modified Poissen process (MMPP) to characterize the traffic flow and to accommodate high variability in traffic flow from one time period to the other. The analysis is performed at multiple time levels using a bottom-up approach. The parameters of the model are adjustable at each level according to the traffic parameters at that level. Each model consists of 2 states of network traffic behavior comprising a bursty state representing heavy traffic conditions and an idle state representing light traffic conditions. A transition window defines the upper time interval for the receipt of packets in the bursty state and the lower time interval for the receipt of packets in the idle state. If the inter-rival times for the bursty state and the idle state become approximately equal, the model defaults to a single state model.

CROSS REFERENCE TO RELATED APPLICATIONS

[0001] The present application is related to the following co-pendingU.S. patent applications: U.S. Ser. No. 09/607,103, filed Jun. 29, 2000,entitled “Method and System for Reducing Latency in Message PassingSystems” (Docket No. RPS920000014US1); U.S. Ser. No. 09/607,113, filedJun. 29, 2000, for “Method and System for Predicting Inter-PacketDelays” (Docket No RPS920000017US1); and U.S. Ser. No. ______, filed______, for “MMPP Analysis of Network Traffic Using a Transition Window”(Docket No. RPS920030018US1). These patent applications all are assignedto the assignee of the present invention. The content of thesecross-referenced co-pending applications is hereby incorporated hereinby reference.

FIELD OF THE INVENTION

[0002] This invention relates in general to the field of computertechnology, and particularly to systems for the transfer of data. Morespecifically, the invention relates to the real-time modeling andanalysis of data communication of self-similar network traffic atmultiple levels.

BACKGROUND OF THE INVENTION

[0003] The flow of information in a network is often called ‘traffic’.Units of information used in network communication are referred to as‘packet’. Packets generally arrive at a point in the network at randomintervals resulting in ‘bursts’ of traffic resulting in congestion and‘idle’ periods in which traffic is somewhat more sparse.

[0004] Systems that use a network to communicate messages can derivesignificant benefits from analysis that provides to the system acharacterization of the network traffic. The Poisson Process is widelyutilized to model aggregate traffic from voice sources. A MarkovModulated Poisson Process (MMPP) is often utilized to model aggregatetraffic from data sources. Network traffic has been shown to beself-similar, therefore, a method used to analyze network traffic shouldbe able to display behavior that is bursty and self-similar.

[0005] The present method uses a multilevel model that utilizes themodel claimed and described in co-pending patent application DocketNumber RPS920030018US1 filed concurrently herewith and entitled MMPPANALYSIS OF NETWORK TRAFFIC USING A TRANSITION WINDOW as the base andreplicating the model once for each time-scale displayed by theself-similar traffic. A single level, 2 state MMPP model is shown inFIG. 1.

SUMMARY OF THE INVENTION

[0006] The present method and system serve to model and analyzeasynchronous network traffic that is bursty and self-similar using aMarkov modulated Poisson process (MMPP) and self-similar traffic bymaking the MMPP model multilevel, where each level in the modelrepresents a different time scale. By ‘self-similar’ is meant that thetraffic displays the same characteristics of behavior (e.g. bursty oridle) at different time scales. This permits the same principles such asan MMPP model to be applied at each different scale. The model employs atransition window to determine the transition between states. Thistransition window is represented as [λ^(B) _(min), λ^(I) _(min)] whereinλ^(B) _(max) is the upper boundary for heavy traffic arrival in thebursty state and λ^(I) _(min) is the lower boundary for light trafficarrival in the idle state.

[0007] The complexity of the model grows as the number of levels in themodel increases. This is not a problem because a model with something inthe order of four levels has been deemed to be adequate. For example,others have confirmed that TCP traffic has been is described by at mostfour time scales. The present invention describes an example of athree-level model, although the model is general enough to represent anynumber of time scales. This model is an effective means to provide fornetwork traffic analysis either in batch mode or in real time.

[0008] The invention relates to an article comprising acomputer-readable medium which stores computer-executable instructionsfor processing traffic flow patterns associated with network datatransmission. The instructions cause a machine to: a) receive trafficpattern data associated with the network transmission of data packetsrelating to the times of arrival of network data packets; b) apply anMMPP algorithm to the received pattern to define the traffic as being inthe bursty state or the idle state; and c) repeat the steps a) and b)one or more additional times at different time-scale levels. Thedifferent time levels are based on a bottom-up analysis and rely on thegeneration of a trace of a traffic pattern for a given time scale andthe analysis of the trace to generate a trace of the next scale pattern.The algorithm utilizes a transition window to determine the transitionbetween states. This transition window is represented as [λ^(B) _(max),λ^(I) _(min)] wherein λ^(B) _(max) is the upper boundary for heavytraffic arrival in the bursty state and λ^(I) _(min) is the lowerboundary for light traffic arrival in the idle state.

[0009] The system analyzes network traffic that is bursty and selfsimilar. It employs an MMPP to model network traffic (in real time or ina batch model) at a first level representing a given time scale. It thenrepeats the process to model the network traffic at one or moreadditional levels representing time scales that differ from the timescale in the first step. Each level typically includes 2 states ofnetwork traffic behavior comprising a bursty state representing heavytraffic conditions and an idle state representing light trafficconditions. The system employs a transition window to determine thetransition between states. This transition window is represented as[λ^(B) _(max), λ^(I) _(min)] wherein λ^(B) _(max) is the upper boundaryfor heavy traffic arrival in the bursty state and λ^(I) _(min) is thelower boundary for light traffic arrival in the idle state. However,when the inter-arrival times for the bursty state and the idle statebecome approximately equal, the system defaults to a single state model.The analysis comprises the generation of a trace of a traffic patternfor a given time scale. This generated trace is then used to generate atrace of the next time scale pattern.

BRIEF DESCRIPTION OF THE DRAWINGS

[0010]FIG. 1 depicts an MMPP for modeling burst network traffic;

[0011]FIG. 2 is an illustration of a 3 level MMPP model;

[0012]FIG. 3 is a diagram of bursty, self similar network traffic;

[0013]FIG. 4 is a flow chart showing the generation of algorithm τ_(A);

[0014]FIG. 5 is a flow chart showing the generation of algorithm τ_(B);

[0015]FIG. 6 is a diagram of a 3-level, 6-state heavy, bursty, selfsimilar network traffic;

[0016]FIG. 7 is a diagram of a 2-level, 4 state MMPP model;

[0017]FIG. 8 is a diagram of 1 level, 2 state bursty, self similarnetwork traffic;

[0018]FIG. 9 is a diagram of 1 level, 1 state bursty model with lighttraffic, not bursty;

[0019]FIG. 10 shows an MMPP model having K-levels, and N-states forhandling variable traffic; and

[0020]FIG. 11 represents one medium for the execution of the program.

DETAILED DESCRIPTION OF THE INVENTION

[0021] An MMPP model 110, also sometimes referred to as a bimodalsequencer, is shown in FIG. 1. The model serves to predict inter-messagearrival delays. The bursty state 112 describes the network trafficbehavior when a burst of packets 114 occurs during heavy trafficconditions. During these bursts, the inter-arrival time between packetsis Poisson distributed having a mean value for the time of λ^(B)_(mean). The idle state 118 describes the network traffic betweenbursts, when the traffic characteristic 120 is light traffic with aPoisson distribution having a mean value of λ^(I) _(mean) for theinter-arrival time. For the 2-state MMPP model to be a validrepresentation of the network traffic, the characteristics of thetraffic are such that the mean time intervals during heavy (bursty)traffic are substantially shorter than the corresponding time intervalsduring light (idle) traffic, i.e. λ^(B) _(mean)<λ^(I) _(mean). In themodel, the traffic inter-arrival times for the bursty and idle statesare represented by the boundary values λ^(B) _(max) and λ^(I) _(min)respectively. For the special case where λ^(I) _(mean) approximatelyequal to λ^(B) _(mean), the model defaults to a single state model.These values are used as the transition criteria between states, asshown in FIG. 1 (λ represents the inter-arrival time of the last packetreceived). When the inter-arrival time slows down so that λ>λ^(I) _(min)and λ>λ^(B) _(max), the model transitions at 116 from the bursty stateto the idle state. Conversely, when the arrival time becomes faster andλ<λ^(I) _(min) and λ<^(B) _(max), the model returns along 122 to thebursty state.

[0022] Since the representation of the network traffic in a model is anapproximation, the length of the burst during state P^(B) is anapproximation with burst edges that are defined somewhat arbitrarily. Inpractice, the burst length is defined to satisfy the requirements of theuser process. As previously mentioned, these values are used as thetransition criteria between states. These boundary values define atransition window [λ^(B) _(max), λ^(I) _(min)] that has as the left sidethe parameter λ^(B) _(max) and as the right hand side the parameterλ^(I) _(min). The first parameter λ^(B) _(max) determines an upper boundfor the packet inter-arrival time for the bursty state and the parameterλ^(I) _(min) determines a lower bound for the packet inter-arrival timefor the idle state. For the bursty state, λ^(B) _(max) defines theprobability ρ^(B) that a packet with inter-arrival time lower than λ^(B)_(max) belongs to the bursty state. Similarly, for the idle state, λ^(I)_(min) defines the probability ρ^(I) that a packet with inter-arrivaltime higher than λ^(I) _(min) belongs to the idle state. Based on theseprobabilities, a decision can be made for each arriving packet of theparticular state transition induced by the arrival.

[0023] Algorithms are described that allow the model to track changes inthe network traffic dynamically. As the network traffic characteristicschange over time, the mean inter-arrival times for the bursty state(λ^(B) _(mean)) and for the idle state (λ^(I) _(mean)) also change overtime. For the model to track these changes over time, the values λ^(B)_(max) and λ^(I) _(min) change in proportion to the changes in thetraffic. The values λ^(B) _(max) and λ^(I) _(min) define the sides of atransition window of length k=λ^(I) _(min)−λ^(B) _(max). The size of thetransition window [λ^(B) _(max),λ^(I) _(min)] can be changed dynamicallyto be used in adaptive algorithms that control the process transitionbetween states. For implementation in an algorithm used in that fashion,the transition window [λ^(B) _(max), λ^(I) _(min)] can grow larger andsmaller by changing the value of λ^(I) _(min) and λ^(B) _(max)accordingly. The specific value of the parameters used depends on thespecific application of the algorithm.

[0024] Referring now to FIG. 2, the model consists of multiple 2-stateMMPP models, with each level specialized to a given scale of theself-similar network traffic. Each 2-state MMPP model shown in FIG. 2consists of a “bursty” state P^(B), and an “idle” state P^(I). Themultilevel model involves the analysis needed to determine threedifferent time scales, it being understood that this number of levels isillustrative only. The present invention uses a constructive/bottom-upapproach, commencing with the shortest intervals between packetarrivals, and moving progressively to the longest inter-arrival times.Each level of self-similarity is analyzed and a trace representation oftraffic at each corresponding level is generated and analyzed. Startingwith the low-level traffic pattern 202 where the inter-arrival timesare, e.g. 1 ms or less, λ is in the idle state if it is more than λ¹_(max) and more than λ² _(min) and in the bursty state if less than λ¹_(max) and λ² _(min). A trace of that traffic pattern is generated,stored and then analyzed to generate a trace of the next time scalepattern 204 having inter-arrival times are e.g., 1000 ms or less. Thattrace and the time scale parameters are analyzed and stored. If λ ismore than λ³ _(max), it is in the bursty state and more than λ⁴ _(min),it is in the idle state. Each trace is then analyzed in similar fashionuntil the highest level time scale 206 (inter-arrival times of, forinstance, 1 second or less) is reached and λ is compared with λ⁵ _(max)and λ⁶ min. The stored traces are used to maintain historical data forthe analysis algorithms. These algorithms are described here.

[0025] The analysis generates a sequence of traces of the form τ¹.τ², .. . , τ^(k), where τ^(k)={(Λ^(k) ₁,P^(k) ₁), (Λ^(k) ₂,P^(k) ₂), . . . ,(Λ^(k) _(i),P^(k) _(i))}. Each trace τ^(k) represents a differentcharacteristic scale of the self-similar network traffic at a differentscale and where, Λ^(k) _(i)=the time stamp of leading of the packet andP^(k) _(i)=the packet/burst size.

[0026] Packet arrivals and inter-burst transitions are detected in thefollowing manner. Assume that packet P_(i−1) presently belongs to burststate P¹. Then, the task is to detect whether packet P_(i) belongs stillto burst state P¹ or to the idle state P². The detection logic comparesthe incoming packet inter-arrival time λ_(i) with λ^(B) _(max) and λ^(I)_(min). Four cases are possible:

[0027] Case 1. λ_(i)<λ^(B) _(max) and λ_(i)<λ^(I) _(min): P_(i) isdetected to belong to burst state P^(B).

[0028] Case 2. λ_(i)>λ^(B) _(max) and λ_(i)>λ^(I) _(min): P_(i) isdetected to belong to idle state P^(I).

[0029] Case 3. λ_(i)>λ^(B) _(max) and λ_(i)<λ^(I) _(min): P_(i) isdetected to be inside of the transition window [λ^(B) _(max), λ^(I)_(min)]

[0030] In case 3, the next state transition selected is dependent on theuser process requirements. This method can be applied to improve theperformance of the network attached devices as will be describedhereinafter. In particular, the application of the transition windowapproach will be described for managing the synchronization process inlow-latency, high-bandwidth networks.

[0031] Case 4. λ_(i)<λ^(B) _(max) and λ_(i)>λ^(I) _(min): This is not avalid combination because both events can not occur at the same time.

[0032] These four cases (304, 306, 308, and 310) are illustrated in FIG.3. The transition window [λ^(B) _(max), λ^(I) _(min)] is illustrated asa rectangle 312, the packet arrivals as vertical arrows 302, and theincoming packet P_(i) 302 illustrated as an X.

[0033] The traffic analysis algorithm has to accomplish several things:

[0034] 1. Analyze the traffic to determine the type of traffic at thetime. Then it has to adjust the parameters of the model to the trafficparameters.

[0035] 2. For bursty self-similar traffic, but for other traffic aswell, the algorithm analyzes the traffic to determine the parameters foreach different time scale. Then it adjusts the parameters of the modelto the traffic parameters.

[0036] 3. It detects the changes to the traffic from time to time,adjusting the model parameters as needed.

[0037] Of course, these are all different aspects of the same problem,that of having the capability to represent highly variable networktraffic.

[0038] Although typically the network traffic can be characterized asbeing bursty and self-similar, as described by the multi-scale MMPPmodel described above, the conditions of the traffic are such that ahigh variability can be expected from one time period to the other(minute to minute, hour to hour, day to day, week to week, etc.). It isimportant for the model used by the methodology to be able to capturethis variability in a dynamic way, real-time. The model of the inventionassumes bursty self-similar traffic, but it adapts to changes in thetraffic from very light traffic, when traffic is not bursty, to moreheavy bursty traffic, on to very heavy peaks where the traffic acquiresself-similar characteristics. The model assumes the structure of a2-state multilevel model, or a simpler 2-state single-level model or asingle-state model, depending on the traffic. Between the two extremes,there is a continuum of conditions that are represented by the model.The model restructures itself adaptively to the changing conditions ofthe network traffic. For example, under light traffic conditions, thenetwork traffic can be characterized by a simple Poisson distribution.As traffic intensity goes down, the mean inter-arrival time λ^(B)_(mean) approaches that of the idle state inter-arrival time λ^(I)_(mean) to the point where the two are no longer distinguished by themodel. When the characteristics of the traffic are such that λ^(I)_(mean) approximately equals λ^(B) _(mean), a single state in the MMPPmodel represents the network traffic.

[0039] For the purposes of the model, the following states areconsidered, along with the related parameters in FIGS. 6-9.

[0040] a) 3-level, 6-state MMPP model: heavy, bursty, self-similartraffic. (FIG. 6)

[0041] b) 2-level, 4-state MMPP model: bursty, self-similar traffic.(FIG. 7)

[0042] c) 1-level, 2-state MMPP model: bursty traffic. (FIG. 8)

[0043] d) 1-level, 1-state MMPP model: light traffic, not bursty. (FIG.9)

[0044] The theoretical maximum number of levels in the model depends onthe number of different time scales displayed by the network traffic.That number is believed to be in the range of four levels. In practice,the scale will also be determined by one of the following conditions:

[0045] 1. The length of the trace is too short to capture theinformation at scales beyond some number of levels.

[0046] 2. The higher the time scale, both the storage requirementsneeded to handle a longer trace and the required computational timeswill be higher. Because of the storage and computational requirementsfor each level, some practical limit needs to be defined to the system.

[0047] 3. The number of levels is defined as a system parameter. Thetime scales will not reflect self-similar traffic beyond some specifiedvalue. Therefore, the value should be established experimentally by thedesigner. Once an upper limit has been established for the differenttime scales, the procedure will track changes to the workloadautomatically and will adjust to the instantaneous burstiness of theworkload. The method must then track traffic changes from one end of thespectrum to the other (a to d above).

[0048] Other, more complicated modeling schemes are possible. However,this example represents an adequate implementation of the invention.

[0049] As previously noted, the traffic burst analysis and tracegeneration consists of the sequential generation of traces of the formτ¹, τ², . . . , τ^(k), where τ^(k)={(Λ^(k) ₁,P^(k) ₁), (Λ^(k) ₂,P^(k)₂), . . . ,(Λ^(k) _(i),P^(k) _(i))}. Each trace τ^(k) represents adifferent characteristic scale of the self-similar network traffic at adifferent scale where Λ^(k) _(i)=time stamp of leading of the packet andP^(k) _(i)=the packet/burst size. This process applies a constructive orbottom-up approach (vs. a deconstructive or analytical approach, whichis top-down.)

[0050] The input stream of each packet (i) is analyzed as shown in FIG.4 (algorithm τ_(A)).

[0051] Burst inter-arrival time, λ¹ _(i)=Λ¹ _(i)−Λ¹ _(i−1), as follows:

[0052] λ¹ _(i)=the inter-arrival time between packets P¹ _(i),

[0053] λ² _(i)=the inter-arrival time between bursts of packets P² _(i),

[0054] λ³ _(i)=the inter-arrival time between clusters (a burst ofbursts) P³ _(i),

[0055] λ^(j) _(i)=the inter-arrival time between bursts of clustersP^(j) _(i)

[0056] The trace τ¹ is generated at 402 as follows. An incoming packet(i) is read at 404 and i is set to a value of 1. The leading edge of thepacket i is detected at 406. If the leading edge is not found, a secondattempt is made to detect it. If detected, the arrival time is stored at408 as time stamp t=Λ_(i). The arrival of the trailing edge of thepacket is detected at 410 and the formula P_(i)=t−Λ_(i) representing thetime interval between the detection of the leading edge and the trailingedge and the time stamp is calculated and recorded. If the trailing edgeis not detected the first time, the process is repeated until detected.The packet size is then stored at 412. This process is repeated for eachpacket until the end of the trace is reached at 414. If the end is notreached, then the process is repeated for the next packet, i=i+1. Theend of the trace is signaled at 418.

[0057] The four test cases are as follows:

[0058] Case 1. λ_(i)<λ^(B) _(max) and λ_(i)<λ^(I) _(min): P_(i) isdetected to belong to burst state P^(B).

[0059] Case 2. λ_(i)>λ^(B) _(max) and λ_(i)>λ^(I) _(min): P_(i) isdetected to belong to idle state P^(I).

[0060] Case 3. λ_(i)>λ^(B) _(max) and λ_(i)<λ^(I) _(min): P_(i) isdetected to be inside of the transition window [λ^(B) _(max), λ^(I)_(min)]. In this case, the next state transition selected is dependenton the user process requirements.

[0061] Case 4. λ_(i)<λ^(B) _(max) and λ_(i)>λ^(I) _(min): This is not avalid combination because both can not occur.

[0062] The following trace is recorded into an ordered set withsequential format. Assume the following:

τ¹={(Λ¹ ₁ ,P ¹ ₁),(Λ¹ ₂ ,P ¹ ₂), . . . ,(Λ¹ _(i) ,P ¹ _(i))},

[0063] Where,

[0064] Λ¹ _(i)=the time stamp of leading of the packet,

[0065] P¹ _(i)=the packet size in microseconds.

[0066] Next, trace τ_(j) can be analyzed as shown in FIG. 5 (algorithmτ_(B)). The trace generation starts at 502 as follows. The previousalgorithm τ_(j−l) is read at 504 and i is set to a value of 1. Theleading edge of the packet j is determined at 506. If the leading edgeis not found, a second attempt is made to detect it. If detected, thearrival time is stored at 508 as time stamp t=Λ_(j). With the arrivaltime of the leading edge stored, the arrival of the trailing edge isdetected at 510 and the formula P_(i)=t−Λ_(j) representing the timeinterval between the detection of the leading edge and the trailing edgeand the time stamp is recorded. The packet arrival is then testedλ^(j−1) _(max)<λ^(j) _(min)<λ^(j) _(i)<λ^(j) _(max)<λ^(j+1) _(min) at512. If the packet is determined to be the same pulse at 514, the packetis again sent to 510 to detect the trailing edge. If it is not the samepulse, the value _(Pj)=t−Λ_(j) is stored at 516. This procedure isrepeated for each packet until the end of the trace is reached at 518.If this does not represent the end of the trace, the process is repeatedfor the next packet j=j+1 at 522. The end of the trace is signaled at518.

[0067] From the analysis, the following trace is derived:

τ² 32 {(Λ² ₁ ,P ² ₁),(Λ² ₂ ,P ² ₂), . . . , (Λ² ₁ ,P ² ₁)},

[0068] Each trace can thus be analyze to produce a higher level trace.In general, the following set of traces are derived:

τ¹, τ², τ³, . . . , τ^(k),

[0069] where trace τ^(k)={(Λ^(k) _(l),P^(k) ₁), (Λ^(k) ₂,P^(k) ₂), . . ., (Λ^(k) _(i),P^(k) _(i))}, represents a different characteristic scaleof the self-similar network traffic at a different scale.

[0070] Since the scale for each consecutive level is approximated by anexponential distribution, the following ordering is established:

λ^(j−1) _(max)<λ^(j) _(min)<λ^(j) _(i)<λ^(j) _(max)<λ^(j+1) _(min)

EXAMPLE 1

[0071] This relates to a 3 level, 6 state MMPP model to simulate heavytraffic that is bursty and self-similar as shown in FIG. 6. The packetbursts are shown by the vertical arrow clusters 602, and the first timelevel is shown as 604, the second time level as 606, and the third timelevel as 608.

[0072] 1. Use algorithm τ_(A) to analyze input stream and generate traceτ¹={(Λ¹ ₁, P¹ ₁), (Λ¹ ₂,P¹ ₂), . . . ,(Λ¹ _(i),P¹ _(i))}.

[0073] 2. Analyze parameters Λ¹ _(i) (the time stamp of leading of thepacket), and P¹ _(i) (the packet size) from trace τ¹. From this theinter-arrival time λ_(i) is computed. Thus, there are four possiblecases:

[0074] Case 1. λ_(i)<λ₁ ^(B) _(max) and λ_(i)<λ₁ ^(I) _(min): P_(i) isdetected to belong to burst state P^(B).

[0075] Case 2. λ_(i)>λ₁ ^(B) _(max) and λ_(i)>λ₁ ^(I) _(min): P_(i) isdetected to belong to idle state P^(I).

[0076] Case 3. λ_(i)>λ₁ ^(B) _(max) and λ_(i)<λ₁ ^(I) _(min): P_(i) isdetected to be inside of the transition window [λ₁ ^(B) _(max), λ₁ ^(I)_(min)]. In this case, the next state transition selected is dependenton the user process requirements.

[0077] Case 4. λ_(i)<λ₁ ^(B) _(max) and λ_(i)>λ₁ ^(I) _(1min): This isnot a valid combination because both can not occur.

[0078] These four cases are used as the test criteria in algorithm τ_(B)to generate Λ² _(i) (the time stamp of leading of the burst), and P²_(i) (the burst size). This analysis of trace τ¹ generates trace τ²={(Λ²₁, P² ₁), (Λ² ₂,P² ₂), . . . , (Λ² _(i),P² _(i))}.

[0079] 2. Analyze parameters Λ² _(i) (the time stamp of leading of thepacket), and P² _(i) (the packet size) from trace τ². From this theinter-arrival time λ_(i) is computed.

[0080] Case 1. λ_(i)<λ₂ ^(B) _(max) and λ_(i)<λ₂ ^(I) _(min): P_(i) isdetected to belong to burst state P^(B).

[0081] Case 2. λ_(i)>λ₂ ^(B) _(max) and λ_(i)>λ₂ ^(I) _(min): P_(i) isdetected to belong to idle state P^(I).

[0082] Case 3. λ_(i)>λ₂ ^(B) _(max) and λ_(i)<λ₂ ^(I) _(min): P_(i) isdetected to be inside of the transition window [λ^(B) _(max), λ^(I)_(min)]. In this case, the next state transition selected is dependenton the user process requirements.

[0083] Case 4. λ_(i)<λ₂ ^(B) _(max) and λ_(i)>λ₂ ^(I) _(min): This isnot a valid combination because both can not occur.

[0084] These four cases are used as the test criteria in algorithm τ_(B)to generate Λ³ _(i) (the time stamp of leading of the burst), and P³_(i) (the burst size). This analysis of trace τ² generates trace τ³={(Λ³₁,P³ ₁),(Λ³ ₂,P³ ₂), . . . ,(Λ³ _(i),P³ _(i))},

[0085] 3. Analyze parameters Λ³ _(i) (the time stamp of leading of thepacket), and P³ _(i) (the packet size) from trace τ³. From this,inter-arrival time λ_(i) is computed. As explained before, four casesare possible:

[0086] Case 1. λ_(i)<λ₃ ^(B) _(max) and λ_(i)<λ₃ ^(I) _(min): P_(i) isdetected to belong to burst state P^(B).

[0087] Case 2. λ_(i)>λ₃ ^(B) _(max) and λ_(i)>λ₃ ^(I) _(min): P_(i) isdetected to belong to idle state P^(I).

[0088] Case 3. λ_(i)>λ₃ ^(B) _(max) and λ_(i)<λ₃ ^(I) _(min), P_(i) isdetected to be inside of the transition window [λ^(B) _(max), λ^(I)_(min)]. In this case, the next state transition selected is dependenton the user process requirements.

[0089] Case 4. λ_(i)<λ₃ ^(B) _(max) and λ_(i)>λ₃ ^(I) _(min): This isnot a valid combination because both can not occur.

[0090] These four cases are used as the test criteria in algorithm τ_(B)to generate Λ⁴ _(i) (the time stamp of leading of the burst), and P⁴_(i) (the burst size). This analysis of trace τ³ generates trace τ⁴={(Λ⁴_(I),P⁴ ₁), (Λ⁴ ₂,P⁴ ₂), . . . , (Λ⁴ _(i),P⁴ _(i))},

EXAMPLE 2

[0091] This relates to a 2-level, 4-state MMPP model to simulate heavytraffic that is bursty and self-similar, as shown in FIG. 7. The packetbursts are shown by the vertical arrow clusters 702. The first level isshown as 704 and the second level as 706.

[0092] Use algorithm τ_(A) to analyze input stream and generate traceτ¹={(Λ¹ ₁,P¹ ₁),(Λ¹ ₂,P¹ ₂), . . . ,(Λ¹ _(i),P¹ _(i))}.

[0093] Analyze parameters Λ¹ _(i) (the time stamp of leading of thepacket), and P¹ _(i) (the packet size) from trace τ¹. From this theinter-arrival time is λ_(i) computed. As explained before, there arefour cases are possible:

[0094] Case 1. λ_(i)<λ₁ ^(B) _(max) and λ_(i)<λ₁ ^(I) _(min): P_(i) isdetected to belong to burst state P^(B).

[0095] Case 2. λ_(i)>λ₁ ^(B) _(max) and λ_(i)>λ₁ ^(I) _(min): P_(i) isdetected to belong to idle state P^(I).

[0096] Case 3, 4: These cases are the same as for Example 1.

[0097] These four cases are used as the test criteria in algorithm s togenerate Λ² _(i) (the time stamp of leading of the burst), and P² _(i)(the burst size). This analysis of trace τ¹ generates trace τ²={(Λ² ₁,P²₁), (Λ² ₂,P² ₂), . . . ,(Λ² _(i),P² _(i))}.

[0098] Analyze parameters Λ² _(i) (the time stamp of leading of thepacket), and P² _(i) (the packet size) from trace τ². From this theinter-arrival time is λ_(i) computed. As explained before, four casesare possible:

[0099] Case 1. λ_(i)<λ₂ ^(B) _(max) and λ_(i)<λ₂ ^(I) _(min): P_(i) isdetected to belong to burst state P^(B).

[0100] Case 2. λ_(i)>λ₂ ^(B) _(max) and λ_(i)>λ₂ ^(I) _(min): P_(i)detected to belong to idle state P^(I).

[0101] Case 3, 4: These cases are the same as for Example 1.

[0102] These four cases are used as the test criteria in algorithm τ_(B)to generate Λ³ _(i) (the time stamp of leading of the burst), and P³_(i) (the burst size). This analysis of trace τ² generates trace τ³={(Λ³₁,P³ ₁),(Λ³ ₂,P³ ₂), . . . ,(Λ³ _(i),P³ _(i))}.

EXAMPLE 3

[0103] This is directed to a 1-level, 2-state MMPP model to simulateheavy traffic that is bursty and self-similar, and is shown in FIG. 8.The packet bursts are shown by the vertical arrow clusters 802, and theonly time level is shown as 804.

[0104] First, use algorithm τ_(A) to analyze input stream and generatetrace τ¹={(Λ¹ ₁,P¹ ₁), (Λ¹ ₂,P¹ ₂), . . . ,(Λ¹ _(i),P¹ _(i))}.

[0105] Then, analyze parameters Λ¹ _(i) (the time stamp of leading ofthe packet), and P¹ _(i) (the packet size) from trace τ¹. From this theinter-arrival time is λ_(i) computed. As explained before, there arefour cases are possible:

[0106] Case 1. λ_(i)<λ₁ ^(B) _(max) and λ_(i)<λ₁ ^(I) _(min): P_(i) isdetected to belong to burst state P^(B).

[0107] Case 2. λ_(i)>λ₁ ^(B) _(max) and λ_(i)>λ₁ ^(I) _(min): P_(i) isdetected to belong to idle state P^(I).

[0108] Case 3, 4: These cases are the same as for Example 1.

[0109] These four cases are used as the test criteria in algorithm τ_(B)to generate Λ² _(i) (the time stamp of leading of the burst), and P²_(i) (the burst size). This analysis of trace τ¹ generates trace τ²={(Λ²₁,P² ₁),(Λ² ₂,P² ₂), . . . ,(Λ² _(i),P² _(i))}.

EXAMPLE 4

[0110]FIG. 9 shows a 1-level, 1-state MMPP model to simulate lighttraffic that is not bursty, with the packet arrivals shown as 902, andthe time line as 904. It involves the following steps:

[0111] 1. Use algorithm τ_(A) to analyze input stream and generate traceτ¹={(Λ¹ ₁,P¹ ₁),(Λ¹ ₂,P¹ ₂), . . . ,(Λ¹ _(i),P¹ _(i))}

[0112] 2. Analyze parameters Λ¹ _(i) (the time stamp of leading of thepacket), and P¹ _(i) (the packet size) from trace τ¹.

[0113] 3. From this the inter-arrival time is λ_(i) computed. Asexplained before, there are four possible cases:

[0114] Case 1. λ_(i)<λ₁ ^(B) _(max) and λ_(i)<λ₁ ^(I) _(min): There areno packets detected that belong to burst state P^(B).

[0115] Case 2. λ_(i)>λ₁ ^(B) _(max) and λ_(i)>λ₁ ^(I) _(min) and: Allpacket inter-arrivals are detected as belonging to idle state P^(I).

[0116] Case 3, 4: These cases are the same as for Example 1.

[0117] These four cases are used as the test criteria in algorithm τ_(B)to generate Λ² ₁ (the time stamp of leading of the burst), and P² _(i)(the burst size). Since there are no bursts in this traffic, trace τ²does not exist.

EXAMPLE 5

[0118] A K-level, N-state MMPP model to simulate variable traffic isshown in FIG. 10. The packet bursts are shown by the vertical arrows160. Traffic pattern 1 (130) is not bursty and shows a low density ofarrows 170. Traffic pattern 2 (140) shows 2 states of bursty and idletraffic represented by arrows 170; and traffic pattern n (150)represents bursts of bursts shown by multiple clusters of arrows 180.

[0119] The conditions of the traffic are such that a high variabilitycan be expected from one time period to the other (minute to minute,hour to hour, day to day, week to week, etc.). It is important for themodel used by the methodology to be able to capture this variability ina dynamic way, real-time. The model of the invention assumes burstyself-similar traffic, but it adapts to changes in the traffic from verylight traffic (pattern 1) when traffic is not bursty, to more heavybursty traffic (pattern 2), on to very heavy peaks (pattern 3) where thetraffic acquires self-similar characteristics. The model assumes thestructure of a 2-state multilevel model, or a simpler 2-statesingle-level model or a single-state model, depending on the traffic.Between the two extremes, there is a continuum of conditions that arerepresented by the model. The model restructures itself adaptively tothe changing conditions of the network traffic.

[0120]FIG. 11 shows a computer-readable medium in the form of a floppydisc 160 for containing the software implementation of the program tocarry out the various steps of modeling the network traffic according tothe present invention. Other machine readable storage mediums are fixedhard drives, optical discs, magnetic tapes, semiconductor memories suchas read-only memories (ROMs), programmable (PROMs), etc. The articlecontaining this computer readable code is utilized by executing the codedirectly from the storage device, or by copying the code from onestorage device to another storage device, or by transmitting the code ona network for remote execution.

[0121] While the invention has been described in combination withspecific embodiments thereof, there are many alternatives,modifications, and variations that are likewise deemed to be within thescope thereof. Accordingly, the invention is intended to embrace allsuch alternatives, modifications and variations as fall within thespirit and scope of the appended claims.

What is claimed is:
 1. A system for analyzing network traffic comprisingdata transfer that is bursty and self similar, comprising (a) an MMPPalgorithm to model network traffic in real time or in a batch model at afirst level representing a given time scale; and (b) the repetitive useof the MMPP algorithm to model the network traffic at one or moreadditional levels representing time scales that differ from the timescale in step a).
 2. The system according to claim 1 wherein each modelconsists of 2 states of network traffic behavior comprising a burstystate representing heavy traffic conditions and an idle staterepresenting light traffic conditions.
 3. The system according to claim2 wherein λ^(B) _(max) represents the upper boundary for traffic arrivalin the bursty state, λ^(I) _(min) represents the lower boundary fortraffic arrival in the idle state and [λ^(B) _(max), λ^(I) _(min)]represents a transition window.
 4. The system according to claim 1wherein the model defaults to a single state model as the meaninter-arrival times of packets in the bursty state and in the idle statebecome approximately equal.
 5. The system according to claim 1 furtherincluding the use of a bottom-up analysis of traffic at each level todetermine the traffic pattern at the next time scale.
 6. The systemaccording to claim 5 wherein the analysis comprises the generation of atrace of the traffic pattern for a given time scale.
 7. The systemaccording to claim 6 including the analysis of the generated trace atthe given time scale to generate a trace of the next higher time scalepattern.
 8. The system according to claim 1 further having thecapability of adapting to changes in traffic pattern within a given timescale.
 9. The system according to claim 3 further including the abilityto dynamically adjust the parameters of the transition window inresponse to the incoming traffic load.
 10. The system according to claim9 wherein the transition window is useful for managing the process ofsynchronization of low-latency, high-bandwidth networks.
 11. A methodfor the multi-level analysis of data traffic in a computer networkcomprising: a) generating a trace of low-level traffic pattern; b)analyzing the low-level pattern to generate a trace representing anapproximation of the next time scale pattern, and c) repeating the tracegeneration and analysis for each successive higher level traffic pattern12. The method according to claim 11 including using an MMPP algorithmto generate each model, wherein each model consists of 2 states ofnetwork traffic behavior comprising a bursty state representing heavytraffic conditions and an idle state representing light trafficconditions.
 13. The method according to claim 12 wherein the inter-rivaltimes for the bursty state and the idle state become approximatelyequal, and the model defaults to a single state model.
 14. The methodaccording to claim 13 further including a bottom-up analysis step todetermine the different time scales.
 15. The method according to claim14 wherein the analysis step comprises generating a trace of a trafficpattern for a given time scale.
 16. The method according to claim 14including analyzing the generated trace to generate a trace of the nexttime scale pattern.
 17. The method according to claim 12 includingadapting to changes in traffic pattern within a given time scale. 18.The method according to claim 12 wherein λ^(B) _(max) represents theupper boundary for heavy traffic arrival in the bursty state, λ^(I)_(min) an idle state representing light traffic arrival, and [λ^(B)_(max), λ^(I) _(min)] represents a transition window.
 19. The methodaccording to claim 18 including the step of dynamically adjusting theparameters of the transition window in response to the incoming trafficload.
 20. The method according to claim 19 including the use of thetransition window for managing the process of synchronization oflow-latency, high-bandwidth networks.
 21. An article comprising acomputer-readable medium which stores computer-executable instructionsfor processing traffic flow patterns associated with network datatransmission, the instructions causing a computer to: (a) receivetraffic pattern data associated with the network transmission of datapackets relating to the inter-arrival time of the data packets during atime level when the traffic is self-similar; (b) apply an MMPP algorithmto the received pattern; and (c) repeat the steps (a) and (b) one ormore additional times at different time levels.
 22. The articleaccording to claim 21 wherein the instructions cause a trace to begenerated at the first time level to represent the traffic at thatlevel, and to be analyzed to generate the trace of the pattern at thenext time level.
 23. The article according to claim 22 wherein theinstructions utilize a transition window to predict traffic flow asbeing bursty or as idle.
 24. The article according to claim 23 whereinthe transition window is represented as [λ^(B) _(max), λ^(I) _(min)]wherein λ^(B) _(max) is the upper boundary for heavy traffic arrival inthe bursty state and λ^(I) _(min) is the lower boundary for lighttraffic arrival in the idle state.